docs: def ignore_missing_email_protection_eku_cb(ok, ctx):
      """
      For verifying PKCS7 signature, m2Crypto uses OpenSSL's PKCS7_verify().
      The latter requires that ExtendedKeyUsage extension, if present,
      contains 'emailProtection' OID. (Is it because S/MIME is/was the
      primary use case for PKCS7?)
      We do not want to fail the verification in this case. At present,
      M2Crypto lacks possibility of removing or modifying an existing
      extension. Let's assign a custom verification callback.
      """
      # The error we want to ignore is indicated by X509_V_ERR_INVALID_PURPOSE.
      err = ctx.get_error()
      if err != m2.X509_V_ERR_INVALID_PURPOSE:
          return ok
  
      # PKCS7_verify() has this requriement only for the signing certificate.
      # Do not modify the behavior for certificates upper in the chain.
      if ctx.get_error_depth() > 0:
          return ok
  
      # There is another cause of ERR_INVALID_PURPOSE: incompatible keyUsage.
      # Do not modify the default behavior in this case.
      cert = ctx.get_current_cert()
      try:
          key_usage = cert.get_ext('keyUsage').get_value()
          if 'digitalSignature' not in key_usage \
                  and 'nonRepudiation' not in key_usage:
              return ok
      except LookupError:
          pass
  
      # Here, keyUsage is either absent, or contains the needed bit(s).
      # So ERR_INVALID_PURPOSE is caused by EKU not containing 'emailProtection'.
      # Ignore this error.
      return 1